Network Anomaly Detection via IP Port State Vector Entropy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting anomalous events in networks, such as network attacks, suffer from high false negative and positive rates and are unable to effectively detect changes in traffic patterns, particularly in cases like distributed DoS attacks and port scanning, due to their reliance on temporal complexity and packet size analysis.
Innovation Solution
An apparatus and method that utilize entropy calculations based on IP and port number state vectors to determine anomalous events by analyzing packet movements and updating token numbers, allowing for the discrimination between normal and anomalous traffic patterns, thereby reducing false detection rates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If time series prediction and signal analysis are used to detect anomalous events, then detection accuracy is improved, but temporal complexity increases
Solution Approach 1:
The patent transforms the detection approach by changing from time-series analysis to entropy-based analysis of state vectors. Instead of analyzing temporal patterns directly, it converts traffic data into state vectors representing system states, then calculates entropy to detect anomalies. This parameter transformation reduces temporal complexity while maintaining detection accuracy.
Solution Approach 2:
The patent replaces complex temporal analysis mechanisms with a simpler entropy calculation mechanism. By substituting the mechanical time-series prediction process with an entropy-based state vector analysis, it achieves the same detection goal with reduced computational complexity.
2Reliability
If traffic volume analysis is used to detect anomalous events, then detection capability is improved, but false negative and positive rates increase
Solution Approach 1:
The patent changes the detection parameter from traffic volume to entropy of state vectors. By transforming the measurement parameter from quantitative (packet count) to informational (entropy), it captures the structural characteristics of traffic patterns, enabling more accurate distinction between normal and anomalous events, thus reducing false detection rates.
Solution Approach 2:
The patent introduces state vectors as an intermediary between raw traffic data and anomaly detection. The state vectors serve as a mediating representation that captures essential traffic characteristics, and entropy calculation on these vectors provides a robust anomaly metric, improving detection reliability while reducing false positives.
3Ease of operation
If conventional anomaly detection methods are used, then implementation simplicity is maintained, but ability to detect distributed DoS attacks and port scanning is reduced
Solution Approach 1:
The patent changes the detection parameter from traffic volume to entropy of state vectors, which captures the structural characteristics of traffic patterns. This parameter transformation enables detection of distributed DoS attacks and port scanning by identifying deviations in traffic structure, while maintaining implementation feasibility through systematic entropy calculation.
Solution Approach 2:
The patent segments traffic analysis into state vector representation and entropy calculation components. By dividing the detection process into discrete state transitions and entropy measurements, it achieves both implementation simplicity and enhanced attack detection capability through modular analysis of traffic patterns.
Data Source
AI summary
IP state-vector manager determines state vector value by updating token numbers of IP state vector according to source and destination IP addresses of the received packet, and obtains state number of state vector value by counting state vector value. Port-number state-vector manager determines state vector value by updating token numbers of port-number state vector according to source and destination token numbers of packet, and obtains state number of state vector value by counting state vector value. Entropy calculator calculates entropies related to IP address and port number, based on number and state number of state vector values related to IP state vector and port-number state vector. Anomalous event determiner determines whether there is anomalous event in network based on calculated entropies. Anomalous event can be efficiently detected with minimized false negative and positive rates.